Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

HTML5 has the element that sends an SPKAC to the server (as I understand it).

But how do you do it in IE?

One CA's websites gives me the following prompt:

This Web site is attempting to perform a digital certificate operation on your behalf:

You should only allow known Web sites to perform digital certificate operations on your behalf.
Do you want to allow this operation?

That's cool and all but how do they do it and how do I make it so a website of mine can generate private keys for people? IE doesn't support the keygen element.

share|improve this question
Alternatives to Keygen – LamonteCristo Mar 26 '13 at 14:23
up vote 7 down vote accepted

With Internet Explorer, for this kind of job, you are supposed to use the CertEnroll API (in pre-Vista Windows, this was called XEnroll); it can be used from Javascript. This implies Javascript to detect the type of browser.

Microsoft says that lack of support for <keygen> is "by design".

share|improve this answer
by design == it's not easy for us to add a meatball to our spaghetti – Qix May 13 '15 at 16:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.